@fieldnotes/sync-server 0.18.0 → 0.19.0

package/dist/index.d.ts

@@ -60,6 +60,34 @@ interface ReadContext {
     audience: string | undefined;
 }
 type CanRead = (ctx: ReadContext) => boolean;
+interface OwnerReadContext {
+    userId?: string;
+    role?: string;
+    room: string;
+}
+/**
+ * Decides whether a viewer may see the server-stamped `ownerId` on elements it
+ * receives (live ops, snapshots and corrections). Without a hook `ownerId` is
+ * stripped from every outbound frame; it stays in the backend for `authorize`.
+ */
+type CanReadOwnerId = (ctx: OwnerReadContext) => boolean;
+interface ResolveAudienceContext {
+    userId?: string;
+    role?: string;
+    room: string;
+    /** The incoming element as the client sent it, client-asserted `audience` included. */
+    element: WireSyncElement;
+    /** The hub's stored element for the same id, if any. */
+    currentElement?: OwnedElement;
+}
+/**
+ * Decides the authoritative `audience` of an upserted element. The returned
+ * value replaces whatever the client asserted (`undefined` clears the field)
+ * before `authorize`, storage and relay, so a client can neither hide content
+ * by tagging it nor reveal content by retagging it. Without a hook the
+ * client's tag passes through and `authorize` must check it.
+ */
+type ResolveAudience = (ctx: ResolveAudienceContext) => string | undefined;
 
 interface ApplyResult {
     readonly accepted: WireSyncOp | null;
@@ -108,9 +136,13 @@ interface SyncHubOptions {
     authorizeLayer?: AuthorizeLayer;
     plugins?: readonly ServerSyncPlugin[];
     canRead?: CanRead;
+    canReadOwnerId?: CanReadOwnerId;
+    resolveAudience?: ResolveAudience;
     maxJsonDepth?: number;
     presenceThrottleMs?: number;
     maxPresenceLanes?: number;
+    /** Largest `presence.data` payload relayed, in UTF-8 bytes of its JSON encoding. */
+    maxPresenceBytes?: number;
     /** Registry used to translate extension elements for legacy peers. */
     elementRegistry?: ElementRegistry;
 }
@@ -129,10 +161,13 @@ declare class SyncHub {
     private readonly elementRegistry;
     private readonly peerCapabilities;
     private readonly canRead?;
+    private readonly canReadOwnerId?;
+    private readonly resolveAudience?;
     private readonly memoryLayers;
     private readonly maxJsonDepth;
     private readonly presenceThrottleMs;
     private readonly maxPresenceLanes;
+    private readonly maxPresenceBytes;
     /**
      * Presence throttle state keyed by connection, then by lane. A lane is the
      * payload's `kind` (a non-empty string of at most 64 chars) or the reserved
@@ -171,6 +206,7 @@ declare class SyncHub {
     private getLayerRecords;
     private getLayerRecord;
     private applyLayerRecord;
+    private mayReadOwnerId;
     private mayRead;
     private safePublish;
     private relayToRoom;
@@ -180,7 +216,11 @@ declare class SyncHub {
      * may reject the room operation that produced it.
      */
     private sendToConnection;
-    /** Returns the wire frame for `op` translated for `capabilities`, or null when lossy. */
+    /**
+     * Returns the wire frame for `op` translated for `capabilities`, or null
+     * when lossy. The server-stamped `ownerId` is a server-side authorization
+     * fact: it leaves the hub only for peers `canReadOwnerId` admits.
+     */
     private encodeForPeer;
     /**
      * Normalize registered legacy wire elements before authorization, storage,
@@ -200,6 +240,7 @@ declare class SyncHub {
     private deliverToRoom;
     private sendCorrection;
     private onFanout;
+    private isPresenceWithinLimit;
     private applyFanoutLayerOp;
     close(): void;
 }
@@ -220,12 +261,25 @@ declare class MemoryHubBackend implements HubBackend {
 interface AuthInfo {
     req: IncomingMessage;
     room: string;
+    /**
+     * Bearer token resolved by `readBearerToken(req)`: a `fieldnotes-bearer.<token>`
+     * `Sec-WebSocket-Protocol` entry, else an `Authorization: Bearer` header, else the
+     * `token` URL query parameter (legacy; URLs land in proxy logs). `undefined` when
+     * none is present.
+     */
+    token?: string;
 }
 interface AuthResult {
     userId: string;
     role?: string;
 }
 type Authenticate = (info: AuthInfo) => AuthResult | null | Promise<AuthResult | null>;
+/**
+ * Resolves the bearer token of an upgrade request, preferring channels that stay
+ * out of access logs: `Sec-WebSocket-Protocol` bearer entry, then
+ * `Authorization: Bearer`, then the `token` query parameter.
+ */
+declare function readBearerToken(req: IncomingMessage): string | undefined;
 
 interface CreateSyncServerOptions {
     port?: number;
@@ -238,6 +292,8 @@ interface CreateSyncServerOptions {
     authorizeLayer?: AuthorizeLayer;
     plugins?: readonly ServerSyncPlugin[];
     canRead?: CanRead;
+    canReadOwnerId?: CanReadOwnerId;
+    resolveAudience?: ResolveAudience;
     heartbeatIntervalMs?: number;
     maxMessageBytes?: number;
     maxJsonDepth?: number;
@@ -245,8 +301,23 @@ interface CreateSyncServerOptions {
     maxPendingAuthBytes?: number;
     messagesPerSecond?: number;
     messageBurst?: number;
+    /** Sustained inbound bytes per second per connection (token bucket). */
+    bytesPerSecond?: number;
+    /** Inbound byte spike allowance per connection; a frame larger than this is never admitted. */
+    byteBurst?: number;
     presenceThrottleMs?: number;
     maxPresenceLanes?: number;
+    maxPresenceBytes?: number;
+    /** Concurrent sockets per client address; `Infinity` disables the cap. */
+    maxConnectionsPerIp?: number;
+    /** Concurrent sockets per room, pending-auth sockets included; `Infinity` disables the cap. */
+    maxConnectionsPerRoom?: number;
+    /**
+     * Resolves the client address the per-IP cap keys on. Defaults to the socket's
+     * remote address; behind a trusted proxy read the forwarded header here.
+     * Returning `undefined` or `''` exempts the connection from the per-IP cap.
+     */
+    clientAddress?: (req: IncomingMessage) => string | undefined;
     shutdownGraceMs?: number;
     /**
      * Registry used to translate extension envelopes for legacy peers. Without
@@ -261,6 +332,15 @@ declare function createSyncServer(options?: CreateSyncServerOptions): {
     close: () => Promise<void>;
 };
 
+/**
+ * Room names the relay admits. Backends derive storage keys from the room
+ * name (`<prefix><room>:layers`, `<prefix><room>:fog:meta`, ...), so the
+ * alphabet excludes every separator a key builder uses and bounds the length
+ * before `authenticate` runs.
+ */
+declare const ROOM_NAME_PATTERN: RegExp;
+declare function isValidRoomName(room: unknown): room is string;
+
 interface HeartbeatSocket {
     ping(): void;
     terminate(): void;
@@ -275,4 +355,4 @@ interface Heartbeat {
 }
 declare function startHeartbeat(wss: HeartbeatServer, intervalMs: number): Heartbeat;
 
-export { type ApplyResult, type AuthInfo, type AuthResult, type Authenticate, type Authorize, type AuthorizeContext, type AuthorizeLayer, type AuthorizeLayerContext, type CanRead, type Connection, type CreateSyncServerOptions, type Heartbeat, type HeartbeatServer, type HeartbeatSocket, type HubBackend, type HubFanout, InMemoryHubFanout, MemoryHubBackend, type OwnedElement, type ReadContext, type ServerExtensionRegistry, type ServerNext, type ServerOpContext, type ServerSyncPlugin, SyncHub, type SyncHubOptions, createSyncServer, startHeartbeat };
+export { type ApplyResult, type AuthInfo, type AuthResult, type Authenticate, type Authorize, type AuthorizeContext, type AuthorizeLayer, type AuthorizeLayerContext, type CanRead, type CanReadOwnerId, type Connection, type CreateSyncServerOptions, type Heartbeat, type HeartbeatServer, type HeartbeatSocket, type HubBackend, type HubFanout, InMemoryHubFanout, MemoryHubBackend, type OwnedElement, type OwnerReadContext, ROOM_NAME_PATTERN, type ReadContext, type ResolveAudience, type ResolveAudienceContext, type ServerExtensionRegistry, type ServerNext, type ServerOpContext, type ServerSyncPlugin, SyncHub, type SyncHubOptions, createSyncServer, isValidRoomName, readBearerToken, startHeartbeat };

package/dist/index.js

@@ -3,8 +3,8 @@ import {
   createCurrentCapabilities,
   createLegacyCapabilities,
   parseEnvelope,
+  isValidEnvelope,
   isValidElement,
-  isValidWireElement,
   isNewerLayerRecord,
   translateOpForPeer
 } from "@fieldnotes/sync";
@@ -130,6 +130,11 @@ var DEFAULT_MAX_PENDING_AUTH_BYTES = 2 * 1024 * 1024;
 var DEFAULT_MESSAGES_PER_SECOND = 120;
 var DEFAULT_MESSAGE_BURST = 240;
 var DEFAULT_PRESENCE_THROTTLE_MS = 50;
+var DEFAULT_MAX_PRESENCE_BYTES = 4 * 1024;
+var DEFAULT_BYTES_PER_SECOND = 4 * 1024 * 1024;
+var DEFAULT_BYTE_BURST = 8 * 1024 * 1024;
+var DEFAULT_MAX_CONNECTIONS_PER_IP = 64;
+var DEFAULT_MAX_CONNECTIONS_PER_ROOM = 256;
 var DEFAULT_MAX_PRESENCE_LANES = 16;
 function hasJsonDepthAtMost(message, maxDepth) {
   let depth = 0;
@@ -162,29 +167,30 @@ var MessageRateLimiter = class {
   }
   tokens;
   updatedAt;
-  take(now = Date.now()) {
+  /** Charges `cost` tokens (frames or bytes); a cost above `burst` never fits. */
+  take(now = Date.now(), cost = 1) {
     const elapsedSeconds = Math.max(0, now - this.updatedAt) / 1e3;
     this.tokens = Math.min(this.burst, this.tokens + elapsedSeconds * this.ratePerSecond);
     this.updatedAt = now;
-    if (this.tokens < 1) return false;
-    this.tokens -= 1;
+    if (this.tokens < cost) return false;
+    this.tokens -= cost;
     return true;
   }
 };
 
 // src/sync-hub.ts
 var HUB_FROM = "hub";
+var utf8 = new TextEncoder();
+function utf8ByteLength(text) {
+  return utf8.encode(text).byteLength;
+}
 function generateInstanceId() {
   if (typeof crypto !== "undefined" && typeof crypto.randomUUID === "function")
     return crypto.randomUUID();
   return `i-${Math.random().toString(36).slice(2)}`;
 }
 function isFanoutOp(op) {
-  if (typeof op !== "object" || op === null) return false;
-  const o = op;
-  if (o.kind === "upsert") return isValidWireElement(o.element);
-  if (o.kind === "remove") return typeof o.id === "string";
-  return o.kind === "clear";
+  return op.kind === "upsert" || op.kind === "remove" || op.kind === "clear";
 }
 var FALLBACK_PRESENCE_LANE = "";
 var MAX_PRESENCE_LANE_LENGTH = 64;
@@ -197,9 +203,7 @@ function presenceLaneOf(data) {
   return kind;
 }
 function isLayerOp(op) {
-  if (typeof op !== "object" || op === null) return false;
-  const k = op.kind;
-  return k === "layer-upsert" || k === "layer-remove";
+  return op.kind === "layer-upsert" || op.kind === "layer-remove";
 }
 function layerOpToRecord(op) {
   return op.kind === "layer-upsert" ? { id: op.layer.id, version: op.version, editor: op.editor, definition: op.layer } : { id: op.id, version: op.version, editor: op.editor };
@@ -212,13 +216,22 @@ function layerRecordToOp(record) {
     editor: record.editor
   } : { kind: "layer-remove", id: record.id, version: record.version, editor: record.editor };
 }
-function capabilityProfile(capabilities) {
-  return JSON.stringify([capabilities.elementEnvelope, capabilities.extensionKinds]);
+function encodingProfile(capabilities, revealOwner) {
+  return JSON.stringify([capabilities.elementEnvelope, capabilities.extensionKinds, revealOwner]);
+}
+function withoutOwnerId(element) {
+  if (element.ownerId === void 0) return element;
+  const rest = { ...element };
+  delete rest.ownerId;
+  return rest;
+}
+function stripOwnerId(op) {
+  if (op.kind === "upsert") return { ...op, element: withoutOwnerId(op.element) };
+  if (op.kind === "snapshot") return { ...op, elements: op.elements.map(withoutOwnerId) };
+  return op;
 }
 function isPresenceOp(op) {
-  if (typeof op !== "object" || op === null) return false;
-  const k = op.kind;
-  return k === "presence" || k === "presence-leave";
+  return op.kind === "presence" || op.kind === "presence-leave";
 }
 var SyncHub = class {
   backend;
@@ -237,10 +250,13 @@ var SyncHub = class {
   elementRegistry;
   peerCapabilities = /* @__PURE__ */ new Map();
   canRead;
+  canReadOwnerId;
+  resolveAudience;
   memoryLayers = /* @__PURE__ */ new Map();
   maxJsonDepth;
   presenceThrottleMs;
   maxPresenceLanes;
+  maxPresenceBytes;
   /**
    * Presence throttle state keyed by connection, then by lane. A lane is the
    * payload's `kind` (a non-empty string of at most 64 chars) or the reserved
@@ -260,6 +276,8 @@ var SyncHub = class {
     this.authorize = options.authorize;
     this.authorizeLayer = options.authorizeLayer;
     this.canRead = options.canRead;
+    this.canReadOwnerId = options.canReadOwnerId;
+    this.resolveAudience = options.resolveAudience;
     this.maxJsonDepth = options.maxJsonDepth ?? DEFAULT_MAX_JSON_DEPTH;
     this.presenceThrottleMs = options.presenceThrottleMs ?? DEFAULT_PRESENCE_THROTTLE_MS;
     const maxPresenceLanes = options.maxPresenceLanes ?? DEFAULT_MAX_PRESENCE_LANES;
@@ -267,6 +285,11 @@ var SyncHub = class {
       throw new RangeError("maxPresenceLanes must be a finite number of at least 1");
     }
     this.maxPresenceLanes = Math.floor(maxPresenceLanes);
+    const maxPresenceBytes = options.maxPresenceBytes ?? DEFAULT_MAX_PRESENCE_BYTES;
+    if (!Number.isFinite(maxPresenceBytes) || maxPresenceBytes < 0) {
+      throw new RangeError("maxPresenceBytes must be a non-negative finite number");
+    }
+    this.maxPresenceBytes = maxPresenceBytes;
     this.fanoutUnsub = this.fanout.subscribe((payload) => this.onFanout(payload));
   }
   addConnection(conn) {
@@ -305,6 +328,7 @@ var SyncHub = class {
    * forwards the same event to other instances on a best-effort basis.
    */
   broadcastPresence(room, data) {
+    if (!this.isPresenceWithinLimit(data)) return 0;
     const op = { kind: "presence", data };
     const sent = this.relayToRoom(room, void 0, JSON.stringify({ from: HUB_FROM, op }));
     this.safePublish(JSON.stringify({ o: this.instanceId, room, from: HUB_FROM, op }));
@@ -325,6 +349,7 @@ var SyncHub = class {
       return Promise.resolve();
     }
     if (env.op.kind === "presence") {
+      if (!this.isPresenceWithinLimit(env.op.data)) return Promise.resolve();
       this.schedulePresence(conn, env.op.data);
       return Promise.resolve();
     }
@@ -384,9 +409,22 @@ var SyncHub = class {
       await this.deliverPluginResult(conn, result);
     } else if (op.kind === "upsert" || op.kind === "remove" || op.kind === "clear") {
       const id = op.kind === "upsert" ? op.element.id : op.kind === "remove" ? op.id : void 0;
-      const needCurrent = (this.authorize || this.canRead) && id !== void 0;
+      const needCurrent = (this.authorize || this.canRead || this.resolveAudience) && id !== void 0;
       const storedCurrent = needCurrent ? await this.backend.get(conn.room, id) : void 0;
       const current = storedCurrent ? this.normalizeElement(storedCurrent) ?? void 0 : void 0;
+      if (op.kind === "upsert" && this.resolveAudience) {
+        const audience = this.resolveAudience({
+          userId: conn.userId,
+          role: conn.role,
+          room: conn.room,
+          element: op.element,
+          currentElement: current
+        });
+        const element = { ...op.element };
+        if (audience === void 0) delete element.audience;
+        else element.audience = audience;
+        op = { kind: "upsert", element };
+      }
       let outboundOp = op;
       if (this.authorize) {
         const allowed = await this.authorize({
@@ -547,6 +585,10 @@ var SyncHub = class {
     }
     map.set(record.id, record);
   }
+  mayReadOwnerId(conn) {
+    if (!this.canReadOwnerId) return false;
+    return this.canReadOwnerId({ userId: conn.userId, role: conn.role, room: conn.room });
+  }
   mayRead(conn, audience) {
     if (!this.canRead) return true;
     return this.canRead({ userId: conn.userId, role: conn.role, room: conn.room, audience });
@@ -581,10 +623,11 @@ var SyncHub = class {
    */
   sendToConnection(conn, from, op, encoded) {
     const capabilities = this.peerCapabilities.get(conn.id) ?? createLegacyCapabilities();
-    const profile = encoded ? capabilityProfile(capabilities) : void 0;
+    const revealOwner = this.mayReadOwnerId(conn);
+    const profile = encoded ? encodingProfile(capabilities, revealOwner) : void 0;
     let message = profile === void 0 ? void 0 : encoded?.get(profile);
     if (message === void 0) {
-      message = this.encodeForPeer(from, op, capabilities);
+      message = this.encodeForPeer(from, op, capabilities, revealOwner);
       if (profile !== void 0) encoded?.set(profile, message);
     }
     if (message === null) return false;
@@ -595,11 +638,15 @@ var SyncHub = class {
       return false;
     }
   }
-  /** Returns the wire frame for `op` translated for `capabilities`, or null when lossy. */
-  encodeForPeer(from, op, capabilities) {
+  /**
+   * Returns the wire frame for `op` translated for `capabilities`, or null
+   * when lossy. The server-stamped `ownerId` is a server-side authorization
+   * fact: it leaves the hub only for peers `canReadOwnerId` admits.
+   */
+  encodeForPeer(from, op, capabilities, revealOwner) {
     try {
       const translated = translateOpForPeer(
-        op,
+        revealOwner ? op : stripOwnerId(op),
         capabilities,
         this.elementRegistry,
         this.pluginRegistry.extensionDefinitions
@@ -779,6 +826,7 @@ var SyncHub = class {
     if (correction) this.sendToConnection(conn, HUB_FROM, correction);
   }
   onFanout(payload) {
+    if (!hasJsonDepthAtMost(payload, this.maxJsonDepth)) return;
     let env;
     try {
       env = JSON.parse(payload);
@@ -788,8 +836,11 @@ var SyncHub = class {
     if (typeof env.o !== "string" || typeof env.room !== "string" || typeof env.from !== "string")
       return;
     if (env.o === this.instanceId) return;
-    const op = env.op;
+    const envelope = { from: env.from, op: env.op };
+    if (!isValidEnvelope(envelope)) return;
+    const op = envelope.op;
     if (isPresenceOp(op)) {
+      if (op.kind === "presence" && !this.isPresenceWithinLimit(op.data)) return;
       this.relayToRoom(env.room, void 0, JSON.stringify({ from: env.from, op }));
       return;
     }
@@ -799,8 +850,16 @@ var SyncHub = class {
       this.relayOpToRoom(env.room, void 0, env.from, op);
       return;
     }
-    const plugin = typeof op === "object" && op !== null && op.kind === "extension" ? this.pluginRegistry.extension(op.extensionKind ?? "")?.plugin : typeof op === "object" && op !== null && typeof op.kind === "string" ? this.pluginRegistry.ownerOf(op.kind) : void 0;
-    if (plugin && typeof op === "object" && op !== null) {
+    let plugin;
+    if (op.kind === "extension") {
+      const entry = this.pluginRegistry.extension(op.extensionKind);
+      if (!entry || !entry.kind.codec.validate(op.payload)) return;
+      plugin = entry.plugin;
+    } else {
+      plugin = this.pluginRegistry.ownerOf(op.kind);
+    }
+    if (plugin) {
+      const owner = plugin;
       const previous = this.roomQueues.get(env.room) ?? Promise.resolve();
       const operation = previous.then(async () => {
         const context = {
@@ -809,7 +868,7 @@ var SyncHub = class {
           backend: this.backend,
           backendPlugin: (key) => this.backend.getService?.(key)
         };
-        const accepted = plugin.applyFanout ? await plugin.applyFanout(op, context) : op;
+        const accepted = owner.applyFanout ? await owner.applyFanout(op, context) : op;
         if (accepted) {
           this.relayOpToRoom(env.room, void 0, env.from, accepted);
         }
@@ -831,6 +890,9 @@ var SyncHub = class {
     const prevExisted = env.existed === true;
     this.deliverToRoom(env.room, void 0, env.from, runtimeOp, prevAudience, prevExisted);
   }
+  isPresenceWithinLimit(data) {
+    return utf8ByteLength(JSON.stringify(data) ?? "") <= this.maxPresenceBytes;
+  }
   async applyFanoutLayerOp(room, op) {
     const record = layerOpToRecord(op);
     const current = await this.getLayerRecord(room, record.id);
@@ -846,6 +908,23 @@ var SyncHub = class {
 // src/create-sync-server.ts
 import { WebSocketServer } from "ws";
 
+// src/authenticate.ts
+import { readBearerSubprotocol } from "@fieldnotes/sync";
+function readBearerToken(req) {
+  const fromProtocol = readBearerSubprotocol(headerValue(req.headers["sec-websocket-protocol"]));
+  if (fromProtocol) return fromProtocol;
+  const authorization = headerValue(req.headers["authorization"]);
+  if (authorization) {
+    const match = /^Bearer\s+(\S+)$/i.exec(authorization.trim());
+    if (match?.[1]) return match[1];
+  }
+  const query = new URL(req.url ?? "", "http://localhost").searchParams.get("token");
+  return query || void 0;
+}
+function headerValue(value) {
+  return Array.isArray(value) ? value.join(",") : value;
+}
+
 // src/heartbeat.ts
 function startHeartbeat(wss, intervalMs) {
   if (intervalMs <= 0) {
@@ -877,6 +956,9 @@ function startHeartbeat(wss, intervalMs) {
   return { track, stop: () => clearInterval(interval) };
 }
 
+// src/create-sync-server.ts
+import { BEARER_SUBPROTOCOL_PREFIX, SYNC_WS_SUBPROTOCOL } from "@fieldnotes/sync";
+
 // src/shutdown.ts
 var DEFAULT_SHUTDOWN_GRACE_MS = 5e3;
 function drainWebSocketServer(wss, graceMs) {
@@ -911,16 +993,78 @@ function drainWebSocketServer(wss, graceMs) {
   });
 }
 
+// src/room-name.ts
+var ROOM_NAME_PATTERN = /^[A-Za-z0-9_-]{1,64}$/;
+function isValidRoomName(room) {
+  return typeof room === "string" && ROOM_NAME_PATTERN.test(room);
+}
+
 // src/create-sync-server.ts
+var ConcurrencyCounter = class {
+  constructor(limit) {
+    this.limit = limit;
+  }
+  counts = /* @__PURE__ */ new Map();
+  /** Reserves a slot for `key`; returns a release function, or null when the cap is reached. */
+  acquire(key) {
+    const current = this.counts.get(key) ?? 0;
+    if (current >= this.limit) return null;
+    this.counts.set(key, current + 1);
+    let released = false;
+    return () => {
+      if (released) return;
+      released = true;
+      const remaining = (this.counts.get(key) ?? 1) - 1;
+      if (remaining <= 0) this.counts.delete(key);
+      else this.counts.set(key, remaining);
+    };
+  }
+};
 function rawDataByteLength(data) {
   if (Array.isArray(data)) return data.reduce((total, chunk) => total + chunk.byteLength, 0);
   return data.byteLength;
 }
+function requirePositiveFinite(name, value) {
+  if (!Number.isFinite(value) || value <= 0) {
+    throw new RangeError(`${name} must be a positive finite number`);
+  }
+  return value;
+}
+function requirePositiveIntegerOrInfinity(name, value) {
+  if (value !== Infinity && (!Number.isSafeInteger(value) || value <= 0)) {
+    throw new RangeError(`${name} must be a positive safe integer or Infinity`);
+  }
+  return value;
+}
 function createSyncServer(options = {}) {
   const shutdownGraceMs = options.shutdownGraceMs ?? DEFAULT_SHUTDOWN_GRACE_MS;
   if (!Number.isFinite(shutdownGraceMs) || shutdownGraceMs < 0) {
     throw new RangeError("shutdownGraceMs must be a non-negative finite number");
   }
+  const messagesPerSecond = requirePositiveFinite(
+    "messagesPerSecond",
+    options.messagesPerSecond ?? DEFAULT_MESSAGES_PER_SECOND
+  );
+  const messageBurst = requirePositiveFinite(
+    "messageBurst",
+    options.messageBurst ?? DEFAULT_MESSAGE_BURST
+  );
+  const bytesPerSecond = requirePositiveFinite(
+    "bytesPerSecond",
+    options.bytesPerSecond ?? DEFAULT_BYTES_PER_SECOND
+  );
+  const byteBurst = requirePositiveFinite("byteBurst", options.byteBurst ?? DEFAULT_BYTE_BURST);
+  const maxConnectionsPerIp = requirePositiveIntegerOrInfinity(
+    "maxConnectionsPerIp",
+    options.maxConnectionsPerIp ?? DEFAULT_MAX_CONNECTIONS_PER_IP
+  );
+  const maxConnectionsPerRoom = requirePositiveIntegerOrInfinity(
+    "maxConnectionsPerRoom",
+    options.maxConnectionsPerRoom ?? DEFAULT_MAX_CONNECTIONS_PER_ROOM
+  );
+  if (options.authorize && !options.authenticate) {
+    throw new Error("createSyncServer: `authorize` requires an `authenticate` hook");
+  }
   const hub = new SyncHub({
     backend: options.backend,
     fanout: options.fanout,
@@ -929,17 +1073,34 @@ function createSyncServer(options = {}) {
     authorizeLayer: options.authorizeLayer,
     plugins: options.plugins,
     canRead: options.canRead,
+    canReadOwnerId: options.canReadOwnerId,
+    resolveAudience: options.resolveAudience,
     maxJsonDepth: options.maxJsonDepth ?? DEFAULT_MAX_JSON_DEPTH,
     presenceThrottleMs: options.presenceThrottleMs ?? DEFAULT_PRESENCE_THROTTLE_MS,
     maxPresenceLanes: options.maxPresenceLanes,
+    maxPresenceBytes: options.maxPresenceBytes,
     elementRegistry: options.elementRegistry
   });
   const maxMessageBytes = options.maxMessageBytes ?? DEFAULT_MAX_MESSAGE_BYTES;
-  const wss = options.server ? new WebSocketServer({ server: options.server, maxPayload: maxMessageBytes }) : new WebSocketServer({ port: options.port ?? 0, maxPayload: maxMessageBytes });
+  const handleProtocols = (protocols) => {
+    if (protocols.has(SYNC_WS_SUBPROTOCOL)) return SYNC_WS_SUBPROTOCOL;
+    for (const protocol of protocols) {
+      if (!protocol.startsWith(BEARER_SUBPROTOCOL_PREFIX)) return protocol;
+    }
+    return false;
+  };
+  const wss = options.server ? new WebSocketServer({ server: options.server, maxPayload: maxMessageBytes, handleProtocols }) : new WebSocketServer({
+    port: options.port ?? 0,
+    maxPayload: maxMessageBytes,
+    handleProtocols
+  });
   const heartbeat = startHeartbeat(wss, options.heartbeatIntervalMs ?? 3e4);
   let shuttingDown = false;
   let closePromise;
   let counter = 0;
+  const perIp = new ConcurrencyCounter(maxConnectionsPerIp);
+  const perRoom = new ConcurrencyCounter(maxConnectionsPerRoom);
+  const clientAddress = options.clientAddress ?? ((req) => req.socket.remoteAddress);
   wss.on("connection", (ws, req) => {
     if (shuttingDown) {
       ws.close(1001, "server shutting down");
@@ -953,6 +1114,22 @@ function createSyncServer(options = {}) {
       ws.close(4400, "room required");
       return;
     }
+    if (!isValidRoomName(room)) {
+      ws.close(4400, "invalid room");
+      return;
+    }
+    const address = clientAddress(req);
+    const releaseIp = address ? perIp.acquire(address) : () => void 0;
+    if (!releaseIp) {
+      ws.close(4429, "too many connections");
+      return;
+    }
+    const releaseRoom = perRoom.acquire(room);
+    if (!releaseRoom) {
+      releaseIp();
+      ws.close(4429, "too many connections");
+      return;
+    }
     const connId = `c${++counter}-${Math.random().toString(36).slice(2, 8)}`;
     let state = "pending";
     let closed = false;
@@ -961,10 +1138,8 @@ function createSyncServer(options = {}) {
     let queuedBytes = 0;
     const maxPendingAuthMessages = options.maxPendingAuthMessages ?? DEFAULT_MAX_PENDING_AUTH_MESSAGES;
     const maxPendingAuthBytes = options.maxPendingAuthBytes ?? DEFAULT_MAX_PENDING_AUTH_BYTES;
-    const limiter = new MessageRateLimiter(
-      options.messagesPerSecond ?? DEFAULT_MESSAGES_PER_SECOND,
-      options.messageBurst ?? DEFAULT_MESSAGE_BURST
-    );
+    const limiter = new MessageRateLimiter(messagesPerSecond, messageBurst);
+    const byteLimiter = new MessageRateLimiter(bytesPerSecond, byteBurst);
     const send = (m) => {
       try {
         ws.send(m);
@@ -979,7 +1154,8 @@ function createSyncServer(options = {}) {
         ws.close(1009, "message too large");
         return;
       }
-      if (!limiter.take()) {
+      const now = Date.now();
+      if (!limiter.take(now) || !byteLimiter.take(now, messageBytes)) {
         state = "rejected";
         ws.close(4408, "rate limit exceeded");
         return;
@@ -999,9 +1175,13 @@ function createSyncServer(options = {}) {
     });
     ws.on("close", () => {
       closed = true;
+      releaseIp();
+      releaseRoom();
       if (admitted) hub.removeConnection(connId);
     });
-    Promise.resolve(options.authenticate ? options.authenticate({ req, room }) : { userId: connId }).then((result) => {
+    Promise.resolve(
+      options.authenticate ? options.authenticate({ req, room, token: readBearerToken(req) }) : { userId: connId }
+    ).then((result) => {
       if (closed || state === "rejected" || shuttingDown) return;
       if (!result) {
         state = "rejected";
@@ -1041,8 +1221,11 @@ function createSyncServer(options = {}) {
 export {
   InMemoryHubFanout,
   MemoryHubBackend,
+  ROOM_NAME_PATTERN,
   SyncHub,
   createSyncServer,
+  isValidRoomName,
+  readBearerToken,
   startHeartbeat
 };
 //# sourceMappingURL=index.js.map